d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53

Analysis

max time kernel
149s
max time network
157s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
22-11-2022 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
Size

1.3MB
MD5

1f9d75400779c905da0e4ee69953db7b
SHA1

6be6b9e32c15a5573395d24f657d03f62db26007
SHA256

d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53
SHA512

4928b910fb9e0d73778cd3ff5ac624bedc690770e77e038419e17d030ab7c46f172fbc088a6d5f78d45fa9bd11a37d152f563fc958ac7cf40409c7caebfa8af9
SSDEEP

24576:7rKqlGCPcJKwybUDwEZZODYmR9G+gnbkk6XRJfe3DqYO/KpLwFfngWX4VmJPakF:7rKo4ZwCOnYjVmJPay

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2012 set thread context of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2032	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
2032	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
2032	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
2032	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
2032	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28
PID 2012 wrote to memory of 2032	2012	d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe	28

C:\Users\Admin\AppData\Local\Temp\d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
"C:\Users\Admin\AppData\Local\Temp\d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Users\Admin\AppData\Local\Temp\d4b00034e462ef9f874d653ffde5dc23d70b95e5666a2d9f547a94845d0b0c53.exe
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2032-54-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-55-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-57-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-59-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-61-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-63-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-65-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-68-0x00000000763A1000-0x00000000763A3000-memory.dmp

Filesize
8KB

Download
memory/2032-69-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-70-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-71-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download
memory/2032-73-0x0000000000400000-0x00000000004D9000-memory.dmp

Filesize
868KB

Download